Memory hook: Translate, relay, mark and monitor deliberately.
Must remember
For NAT, identify inside/outside interfaces, matching internal traffic and the external address/pool. Static mappings differ from dynamic pool mappings and PAT overload. Verify translation and statistics tables as well as actual traffic; an ACL used to select NAT traffic is not necessarily a filtering ACL applied to an interface.
DHCP clients discover a server locally; a relay/helper on the appropriate routed interface forwards requests to a remote server. Confirm scope, excluded/reserved addresses, default gateway, DNS options and return routing. DNS resolves names; DHCP assigns configuration; NTP synchronizes time. Their failures can look like application faults.
QoS classification identifies traffic; marking labels it; queueing/scheduling allocates transmission opportunity; policing drops/remarks excess traffic while shaping buffers it to a rate. Congestion avoidance and prioritization trade delay/loss between classes. QoS does not create bandwidth and untrusted endpoint markings should not automatically determine priority.
Syslog severity runs from 0 (emergency) through 7 (debugging); lower numbers are more severe. Collect timestamps and appropriate levels without flooding storage with unneeded debug detail. SNMP supports monitoring; secure versions and restricted managers reduce exposure. NetFlow-like telemetry provides communication summaries rather than full payload capture.
Protect device management using SSH rather than Telnet, individual AAA identities, access restrictions and secure configurations. TFTP is simple and lacks built-in authentication/encryption; FTP has separate control/data behavior. Choose secure transfer methods where supported and protect backups because they can include credentials and topology.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| WAN queue delays voice | Classify/mark and apply a suitable congestion/QoS policy. |
| Remote subnet cannot obtain DHCP | Check relay and scope/return path. |
| Need to verify NAT behavior | Translation/statistics outputs plus end-to-end traffic. |
Traps
- Policing and shaping are not the same operation.
- A NAT-selection ACL does not necessarily filter interface traffic.
Active recall
1. Policing versus shaping?
Policing drops/remarks excess traffic; shaping delays/buffers it to fit a rate.
2. Does QoS increase physical bandwidth?
No. It controls treatment of competing traffic.
3. Which syslog number is most severe?
0, emergency.
4. Why protect configuration backups?
They may contain secrets and detailed security/network settings.
5. What does a DHCP relay solve?
Reaching a server across a routed boundary that client discovery broadcasts cannot cross.